CVE-2017-7991

Critical

Published: 22/04/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.

Risk Assessment

Exploitation of this vulnerability could lead to unauthorized access to the database, jeopardizing the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update Exponent CMS to the latest version to mitigate this vulnerability and review the application's security.

Original NVD description (English source)

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.